Security Update for php5
Summary
DSA-3008-1: php5 - security update. Affects php5 versions < 5.4.4-14+deb7u13. Fixed in 5.4.4-14+deb7u13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a general-purpose scripting language commonly used for web application development. It is widely used due to its versatility and ease of use. However, several vulnerabilities have been discovered in the PHP5 package, which could potentially compromise the security and stability of web applications.
Vulnerability Detail
The vulnerabilities identified in PHP5 include:
-
CVE-2014-3538: This vulnerability allows a remote attacker to cause a denial of service (CPU consumption) by exploiting a flaw in the processing of awk regular expression rules.
-
CVE-2014-3587: The CDF parser of the fileinfo module in PHP5 does not handle malformed files in the Composite Document File (CDF) format correctly, leading to crashes.
-
CVE-2014-3597: The fix for CVE-2014-4049 did not fully address the issue, allowing a malicious server or man-in-the-middle attacker to cause a denial of service (crash) and potentially execute arbitrary code via a crafted DNS TXT record.
-
CVE-2014-4670: PHP5 incorrectly handles certain SPL Iterators, which can be exploited by a local attacker to crash PHP and result in a denial of service.
How To Fix
Minimum fixed version
5.4.4-14+deb7u13
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is essential to apply the security update to ensure the integrity and security of web applications.
Conclusion
It is essential to promptly apply the recommended security update for the php5 package to protect web applications from potential exploitation. Failure to do so may result in the compromise of sensitive data, disruption of services, and unauthorized access to systems. For further support or assistance, please contact DevNack.com.
See every vulnerability recorded for php5 →
FAQ
PHP is a general-purpose scripting language commonly used for web application development. It provides a flexible and easy-to-use platform for creating dynamic websites and web applications.
These vulnerabilities can lead to denial of service attacks, crashes, and potential execution of arbitrary code. This can result in the compromise of sensitive data, disruption of services, and unauthorized access to systems.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by these vulnerabilities. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
No, there are no known workarounds for these vulnerabilities. It is crucial to apply the recommended security update to mitigate the risks.
For further support or assistance regarding vulnerability remediation, you can reach out to info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
